almondoffsec - Network
To escape a locked-down Citrix environnement, team member SAERXCIT (https://twitter.com/SAERXCIT) wrote a basic shellcode loader in OpenEdge...
https://infosec.exchange/@Almond...To escape a locked-down Citrix environnement, team member SAERXCIT (https://twitter.com/SAERXCIT) wrote a basic shellcode loader in OpenEdge ABL, a 40 years old english-like programming language. We're sharing it in the off chance someone else might one day need it:
https://github.com/AlmondOffSec/OpenEdgeABL-Loader
9.12.2024 12:31To escape a locked-down Citrix environnement, team member SAERXCIT (https://twitter.com/SAERXCIT) wrote a basic shellcode loader in OpenEdge...https://infosec.exchange/@Almond...
@sigabrt @yeswehack This issue was assigned CVE-2024-52531. While the CVE description states that the vulnerability cannot be reached from...
https://infosec.exchange/@Almond...@sigabrt @yeswehack This issue was assigned CVE-2024-52531. While the CVE description states that the vulnerability cannot be reached from the network, it seems, in fact, possible (check the blogpost for details).
5.12.2024 10:52@sigabrt @yeswehack This issue was assigned CVE-2024-52531. While the CVE description states that the vulnerability cannot be reached from...https://infosec.exchange/@Almond...
Team member @sigabrt describes a fuzzing methodology he used to find a heap overflow in a public @yeswehack bug bounty program for Gnome:...
https://infosec.exchange/@Almond...Team member @sigabrt describes a fuzzing methodology he used to find a heap overflow in a public @yeswehack bug bounty program for Gnome: https://offsec.almond.consulting/using-aflplusplus-on-bug-bounty-programs-an-example-with-gnome-libsoup.html
30.10.2024 12:51Team member @sigabrt describes a fuzzing methodology he used to find a heap overflow in a public @yeswehack bug bounty program for Gnome:...https://infosec.exchange/@Almond...
New article on F5! A write-up on CVE-2024-45844 a privilege escalation vulnerability in BIG-IP by team member @myst404...
https://infosec.exchange/@Almond...New article on F5! A write-up on CVE-2024-45844 a privilege escalation vulnerability in BIG-IP by team member @myst404
https://offsec.almond.consulting/privilege-escalation-f5-CVE-2024-45844.html
https://infosec.exchange/@Almond...
If you are lucky enough to have a Windows Server Datacenter with Hyper-V, you can automatically activate @M4yFly 's GOAD VMs, so...
https://infosec.exchange/@Almond...If you are lucky enough to have a Windows Server Datacenter with Hyper-V, you can automatically activate @M4yFly 's GOAD VMs, so rebuilding the lab every 180 days is no longer needed. We POCed a Vagrant-style script here:
https://github.com/AlmondOffSec/GOAD_hyperv
#GOAD #activedirectory #hyperv
27.9.2024 12:27If you are lucky enough to have a Windows Server Datacenter with Hyper-V, you can automatically activate @M4yFly 's GOAD VMs, so...https://infosec.exchange/@Almond...
How does F5's Secure Vault, its "super-secure SSL-encrypted storage system" work? Response in this article by team member...
https://infosec.exchange/@Almond...How does F5's Secure Vault, its "super-secure SSL-encrypted storage system" work? Response in this article by team member @myst404
https://offsec.almond.consulting/deep-diving-f5-secure-vault.html
4.6.2024 10:04How does F5's Secure Vault, its "super-secure SSL-encrypted storage system" work? Response in this article by team member...https://infosec.exchange/@Almond...
Got root, what now? Practical post-exploitation steps on an F5 Big-IP appliance, by team members @drm and @myst404...
https://infosec.exchange/@Almond...Got root, what now? Practical post-exploitation steps on an F5 Big-IP appliance, by team members @drm and @myst404
https://offsec.almond.consulting/post-exploiting-f5-BIG-IP.html
29.5.2024 10:00Got root, what now? Practical post-exploitation steps on an F5 Big-IP appliance, by team members @drm and @myst404...https://infosec.exchange/@Almond...
Stoked to see #PassTheCert featured in ippsec ‘s solution to HackTheBox Authority🧑⚖️!Video:...
https://infosec.exchange/@Almond...Stoked to see #PassTheCert featured in ippsec ‘s solution to HackTheBox Authority🧑⚖️!
Video: https://www.youtube.com/watch?v=7AF5riqLy-8
Find the tool here: https://github.com/AlmondOffSec/PassTheCert
11.12.2023 05:40Stoked to see #PassTheCert featured in ippsec ‘s solution to HackTheBox Authority🧑⚖️!Video:...https://infosec.exchange/@Almond...
We updated this old gem by @myst404 to include the new #GLPI decryption...
https://infosec.exchange/@Almond...We updated this old gem by @myst404 to include the new #GLPI decryption algorithm.
https://offsec.almond.consulting/multiple-vulnerabilities-in-glpi.html
15.11.2023 09:03We updated this old gem by @myst404 to include the new #GLPI decryption...https://infosec.exchange/@Almond...
Understanding the different types of LDAP authentication methods is fundamental to apprehend subjects such as relay attacks or...
https://infosec.exchange/@Almond...Understanding the different types of LDAP authentication methods is fundamental to apprehend subjects such as relay attacks or countermeasures. This post by @drm introduces them through the lens of Python libraries.
https://offsec.almond.consulting/ldap-authentication-in-active-directory-environments.html
31.10.2023 12:37Understanding the different types of LDAP authentication methods is fundamental to apprehend subjects such as relay attacks or...https://infosec.exchange/@Almond...
To fix the bypass, @matrix hardened the CSP by restricting allowed domains to reCAPTCHA related...
https://infosec.exchange/@Almond...To fix the bypass, @matrix hardened the CSP by restricting allowed domains to reCAPTCHA related ones.
https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw
22.9.2023 12:26To fix the bypass, @matrix hardened the CSP by restricting allowed domains to reCAPTCHA related...https://infosec.exchange/@Almond...
PoC: ```<iframe srcdoc="<body><script...
https://infosec.exchange/@Almond...PoC:
```
<iframe srcdoc="<body><script src="https://www.gstatic.com/fsn/angular_js-bundle1.js"></script><div ng-app> {{'a'.constructor.prototype.charAt=[].join;$eval('x=eval(atob(`YWxlcnQodG9wLmxvY2F0aW9uKSAK`))');}}</div></body>"></iframe>bbbb
```
https://infosec.exchange/@Almond...
The final payload that worked for the web app and the electron-based one used a base64 encoded string within the eval method. An iframe tag...
https://infosec.exchange/@Almond...The final payload that worked for the web app and the electron-based one used a base64 encoded string within the eval method. An iframe tag is used because the application is a SPA.
22.9.2023 12:24The final payload that worked for the web app and the electron-based one used a base64 encoded string within the eval method. An iframe tag...https://infosec.exchange/@Almond...
This version is vulnerable to sandbox escape with...
https://infosec.exchange/@Almond...This version is vulnerable to sandbox escape with "{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}" (originally found by Gareth Heyes). However, this payload is known to bug if the eval contains a "." (dot character).
22.9.2023 12:24This version is vulnerable to sandbox escape with...https://infosec.exchange/@Almond...
Original CSP included a "script-src https://gstatic.com 'unsafe-eval'" directive. gstatic CDN still hosts out of date...
https://infosec.exchange/@Almond...Original CSP included a "script-src https://gstatic.com 'unsafe-eval'" directive. gstatic CDN still hosts out of date libraries such as AngularJS 1.3.20.
22.9.2023 12:23Original CSP included a "script-src https://gstatic.com 'unsafe-eval'" directive. gstatic CDN still hosts out of date...https://infosec.exchange/@Almond...
A few months ago, Cadence Ember found an HTML injection in the matrix-react-sdk, mostly used by the @element client. The CVE advisory...
https://infosec.exchange/@Almond...A few months ago, Cadence Ember found an HTML injection in the matrix-react-sdk, mostly used by the @element client. The CVE advisory stated that the implemented Content-Security-Policy mitigated the risk of XSS. So, team member S1m poc'ed a bypass. 🧵
22.9.2023 12:22A few months ago, Cadence Ember found an HTML injection in the matrix-react-sdk, mostly used by the @element client. The CVE advisory...https://infosec.exchange/@Almond...
A look back at CVE-2020-0911, a Windows Installer EoP found by jonasLyk with team member...
https://infosec.exchange/@Almond...A look back at CVE-2020-0911, a Windows Installer EoP found by jonasLyk with team member @clavoillotte:
https://offsec.almond.consulting/windows-msiexec-eop-cve-2020-0911.html
https://infosec.exchange/@Almond...
Ghostscript RCE CVE-2023-28879 can impact many applications processing images and PDF files.Discovery and exploitation write-up by team...
https://infosec.exchange/@Almond...Ghostscript RCE CVE-2023-28879 can impact many applications processing images and PDF files.
Discovery and exploitation write-up by team member @sigabrt : https://offsec.almond.consulting/ghostscript-cve-2023-28879.html
https://infosec.exchange/@Almond...